include apt

$apt_origins = [
	'origin=Debian,n=${distro_codename}',
	'origin=Debian,n=${distro_codename}-updates',
	'origin=Debian,n=${distro_codename},label=Debian-Security',
	'origin=Debian,n=${distro_codename}-security,label=Debian-Security',
	'origin=IT-Zukunft Schule,n=${distro_codename},label=IT-Zukunft Schule',
]

class ssh_pubkeys_admins {
	# Mike Gabriel, Fre(i)e Software GmbH
	ssh_authorized_key { 'mike@minobo':
		type => 'ssh-rsa',
		key => 'AAAAB3NzaC1yc2EAAAADAQABAAABAQDn2moKR4u3yJW+/hvwmhUDjiLBxiMPB+46YO9iEo8HXsdulpMi20hi2TTmWA0w3hog1IEnre6C7UGHcZG0HfPg+eROIuuXRcOfg3WP/IBV0KMF4DTa1KDoN/Nw7HMlhWxGxFrdbumAoj/s2ZaA/of1fpaPKOhunF8S9Ch60LYmgnR3tzJW/b0jS9fww8o/rMB3pZy2WSW0uUfpOIbDv+XHhNiC/iu8IgD+M5KkK+qbNZFPoTQkebc0RPRBcOrmEYroofFGg+7jPU++AEKJUKSaGjZRWzACuXiUzTo2F9fT09EMWU4oiYV9zRqjx6ctncwfEB4qOfoRUycfxBSJk7t7',
		user => 'root',
	}
	# Daniel Teichmann, Fre(i)e Software GmbH
	ssh_authorized_key { 'daniel@nwt-01':
		type => 'ssh-rsa',
		key => 'AAAAB3NzaC1yc2EAAAADAQABAAABAQCytDYygwrARkiy/1cQ8x9otmWgE3k6EH3ymeHXaFnP/Du0BDRgGuLtdL1yj4OqE4tKqKdXOa1kULLQdbQ0C0ogGGxpZaza1TdxKTpB2YSx1L3LjhzG4KSr0hz/u9qpk7U1PVRi5N7tO/x7eRZWzbuH5UXxLemb1jj5X+q/siAi+8rFfmQmYta+ea4XDQIjfMiKU5ExGjg3DufhyPtsb75zsU9ZcoXo8j4lkjeCJegK7rdKrlmZqMidrZHd8pPN5Tjrn0LMg1fRL0Z+wwHxawhruaw+LHq2iJ3plWJ9igCwvUcXY3KtL1r9owxZATE5CN17OFxCbEFDqsS63OTYr3Xt',
		user => 'root',
	}

	# Carsten Burkhardt, b-c-s kommunikationslösungen
	ssh_authorized_key { 'carsten@ltsp1':
		type => 'ssh-rsa',
		key => 'AAAAB3NzaC1yc2EAAAADAQABAAABAQDecW+ar6y8TE2gQT3Lg4fkbVAb0lJBlxDIphnlMB+ymzWi3+UaeqG7qoj3UIUsO2XYHnmw9gxODH42lnZMm/VrME760ZBd5oMDPcPSzhweI8NxDe1cn1gQEPhiVEEAoh98MMFuPref/dzWeVF8P6OBOTc92ULKtFecSdgJgBEToYUWtT74aD0aQFXJ/TlnZoGnUGO2kpOiMVnpdI9bU0TfaufqzZHXwh+gGJxVUbdetxjKcOCZMq7BrNYcy5iebkWrvBUtRDbb0Rm2L5MoFv0SWEzob+rGMILnZwzsqQ9QQwtqx8uISQIKuPt4H/9dRNxw+I4ck6qbkxvOwnDBBuNv',
		user => 'root',
	}

	# Frederik Kramer, initOS GmbH
	ssh_authorized_key { 'fkramer':
		type => 'ssh-ed25519',
		key => 'AAAAC3NzaC1lZDI1NTE5AAAAIM9JADumhU9GPPQnr0L9E+4+OcAv/px6fqBsCwO7NcX1',
		user => 'root',
	}
	# Florian Kantelberg, initOS GmbH
	ssh_authorized_key { 'fkantelberg':
		type => 'ssh-ed25519',
		key => 'AAAAC3NzaC1lZDI1NTE5AAAAIP0cV21+V8aNphp7K6aPFx5jXTH6NxLkxB60TjDhdvy9',
		user => 'root',
	}
	# Nico Winkelsträter, initOS GmbH
	ssh_authorized_key { 'nwinkelstraeter':
		type => 'ssh-ed25519',
		key => 'AAAAC3NzaC1lZDI1NTE5AAAAIA1G3CdOGdBHAKJLSktdyTCQ/d8KNXamJ+uzJBNuakWz',
		user => 'root',
	}
}

class ssh_pubkeys_firedadmins {
	# Bad User, Example Project
	ssh_authorized_key { 'badadmin@NOTEBOOK':
		ensure => 'absent',
		type => 'ssh-rsa',
		key => 'AAAAB3NzaC1yc2EAAAADAQABAAABAQC71S/LYktwTalKjE6Sb7XlOyV1tr1O+codh4C3g9uVtjqytYj/Lx6hExxegwN2tiTAjb3skEKpdg7uRbmpEZBtyST/UrrJCB0l0KbjJelfh4MANuRF+H9CNAPwaxcLfCWeTFwmQW8mcSHE20ljY7kpJykEoihBVjK49k+kD+sphIG1o4BU8nQii0i5/U2HqHkPZHzCIjIprN9kTx/n/zMmCLwuIW58KJitG/ttBXPq+TMsN/zcUQm7/PL7UmIMlvUtKzApuM36PUyah7/rpOB5mIYrqFcDXSBUpFLT1CIvfH6ZR5umhnwiRXDsVfP8e0WB1JhOZV1LqOez8s7c4a6/',
		user => 'root',
	}
}

class ssh_pubkeys_backupserver {
	ssh_authorized_key { 'root@backup-01':
		type => 'ssh-rsa',
		key => 'AAAAB3NzaC1yc2EAAAADAQABAAABgQDlj42BaZ8a/pZfy7MkNuo1lIECr0seIwHRAatkh4JK0wbBl1nPK0MoCMKC3z0L3i6IkSC9B3TyphSruUpBPaZcdElYLsr68VTSnCJrOKDu/4A3CM2Y5IXsFZYvExC+oZI5YqZInamSmlWhrXhwgaknSvql0Z5ykv3K6d02B/wIfVUDiYFbj5CgHH9AO1Moq6oeb2hJEWc6HBYxcKkPQWqKi2B3FUI6qAX0Io+pg4Y7n9hRC1hgy7i7F3xlBV4Boi7g5Dn6WPI3dliHTT+dq0Q7KDw2kwQc/oPuecCjdfHUT2gZ7rnYx2uXHiSOknUzlqHM0vJv55CSE/HW9sm1z8y7vgBVkel5Qt0mD8hLHwrCI+gG/HYMsxqL7q5sdRpMEV4rSGpRWtlKR1rEYwZknbiJAM9pwsiEpzj7B5l3NmAGs9IryvaHKCPBQTdLDCtZ+g9i4GlKtV+9fG3K032wrp3vvGyJeOTfDqlRt/MJmNkMoYlYDi02yyeSLCsSVNspzuU=',
		user => 'root',
	}
}

class cups_browsed_polling {

	file { '/etc/apparmor.d/local/usr.sbin.cups-browsed':
		content => "/etc/cups/cups-browsed-debian-edu.conf r,\n",
	}
	~> exec { '/usr/bin/systemctl restart apparmor.service': refreshonly => true }
	~> exec { '/usr/bin/systemctl restart cups-browsed.service': refreshonly => true }

	exec { 'cups-browsed-reload':
		command     => '/usr/sbin/service cups-browsed restart',
		subscribe   => [File_line['cups-browsed-create-remote-cups-printers'], File_line['cups-browsed-poll-ipp-intern'], File_line['cups-browsed-queue-naming'], File_line['cups-browsed-no-remote-protos'], File_line['cups-browsed-no-local-protos']],
		refreshonly => true,
	}

	exec { 'cups-delete-dead-printers':
		command     => '/bin/bash -c "LANG=C lpstat -a | grep \"not accepting requests\" | cut -d \" \" -f1 | while read printer; do lpadmin -x \$printer; done"',
		subscribe   => File_line['cups-browsed-no-remote-protos'],
		refreshonly => true,
	}

	file_line { 'cups-browsed-create-remote-cups-printers':
		path               => '/etc/cups/cups-browsed.conf',
		ensure             => present,
		line               => "CreateRemoteCUPSPrinterQueues Yes",
		match              => '^CreateRemoteCUPSPrinterQueues.*',
	}

	file_line { 'cups-browsed-no-remote-protos':
		path               => '/etc/cups/cups-browsed.conf',
		ensure             => present,
		line               => "BrowseRemoteProtocols none",
		match              => '^BrowseRemoteProtocols.*',
	}

	file_line { 'cups-browsed-no-local-protos':
		path               => '/etc/cups/cups-browsed.conf',
		ensure             => present,
		line               => "BrowseLocalProtocols none",
		match              => '^BrowseLocalProtocols.*',
	}

	file_line { 'cups-browsed-queue-naming':
		path               => '/etc/cups/cups-browsed.conf',
		ensure             => present,
		line               => "LocalQueueNamingRemoteCUPS RemoteName",
		match              => '^LocalQueueNamingRemoteCUPS.*',
	}

	file_line { 'cups-browsed-poll-ipp-intern':
		path               => '/etc/cups/cups-browsed.conf',
		ensure             => present,
		line               => "BrowsePoll ipp.intern",
		match              => '^BrowsePoll\ .*',
		append_on_no_match => true,
	}
}

class itzks_systems_common {
	package { 'itzks-systems-common':
		ensure => 'latest',
	}
}

class itzks_systems_workstation {
	package { 'itzks-systems-workstation':
		ensure => 'latest',
	}
}

class itzks_systems_roamingworkstation {
	package { 'itzks-systems-roamingworkstation':
		ensure => 'latest',
	}
}

class itzks_systems_tablet {
	package { 'itzks-systems-tablet':
		ensure => 'latest',
	}
}

class itzks_systems_mainserver {
	package { 'itzks-systems-mainserver':
		ensure => 'latest',
	}
}

class itzks_systems_faiserver {
	package { 'itzks-systems-faiserver':
		ensure => 'latest',
	}
}

class itzks_systems_filter {
	package { 'itzks-systems-filter':
		ensure => 'latest',
	}
}

class itzks_systems_disklserver {
	package { 'itzks-systems-disklserver':
		ensure => 'latest',
	}
}

class lsb_release_with_version {
	file { '/etc/lsb-release':
		ensure => present,
	}
	file_line { 'lsb-release-with-version':
		path  => '/etc/lsb-release',
		line  => "DISTRIB_DESCRIPTION=\"Debian Edu / Skolelinux ${::operatingsystemrelease}\"",
		match => "^DISTRIB_DESCRIPTION=\"DebianEdu/Skolelinux\"$",
	}
	file_line{ 'lsb-release-remove-cruft-1':
		path   => '/etc/lsb-release',
		ensure => absent,
		line   => 'DISTRIB_DESCRIPTION="DebianEdu/Skolelinux"',
	}
}

class login_manager {
	package { 'arctica-greeter':
		ensure => 'installed',
	}
	package { 'kdm':
		ensure => 'purged',
	}
	package { 'sddm':
		ensure => 'purged',
	}
	package { 'gdm3':
		ensure => 'purged',
	}
}

class browser_firefox {
	package { firefox-esr:
		ensure => 'latest',
	}
}
class browser_chromium {
	package { chromium:
		ensure => 'latest',
	}
}

#node "all_hosts" {
#	class { 'ssh_pubkeys_admins': }
#	class { 'ssh_pubkeys_firedadmins': }
#	class { 'lsb_release_with_version': }
#	class { 'login_manager': }
#}

#node "all_servers" {
#	class { 'ssh_pubkeys_admins': }
#	class { 'ssh_pubkeys_firedadmins': }
#	class { 'ssh_pubkeys_backupserver': }
#	class { 'lsb_release_with_version': }
#}

node "tjener.intern" {
	class { 'ssh_pubkeys_admins': }
	class { 'ssh_pubkeys_firedadmins': }
	class { 'ssh_pubkeys_backupserver': }
	class { 'lsb_release_with_version': }
	class { 'browser_firefox': }
	class { 'browser_chromium': }
	class { 'unattended_upgrades':
		enable => 1,
		origins => $apt_origins,
		age => { 'max' => 10 },
		auto => {
			'clean' => 7,
			### WE DON'T REBOOT TJENER
		},
		upgradeable_packages => {
			download_only => 1,
			debdelta => 1,
		},
	}
	class { 'itzks_systems_mainserver': }
	class { 'itzks_systems_common': }
}

node "disklserver.intern" {
	class { 'ssh_pubkeys_admins': }
	class { 'ssh_pubkeys_firedadmins': }
	class { 'ssh_pubkeys_backupserver': }
	class { 'lsb_release_with_version': }
	# vidar.das-netzwerkteam.de is the deployment source for diskless workstation chroots
	ssh_authorized_key { 'root@vidar.das-netzwerkteam.de':
		type => 'ssh-rsa',
		key => 'AAAAB3NzaC1yc2EAAAADAQABAAABAQDiLGbx/U9slB9db8PAy8FTRo7/avVvLJUOZzkoBxZa5Edeo+74ezoU2Kv1OxcRJRnSGBe41XDcpLxDS04JMA5xBddUfdq5c+Y1A2SYChUPK1fkrGoKfmGC60dFmEqAQZ33dJhN9rxzQvuvxlmexX8x2TYJC8/jATa+6QuO4chHAFvGo9RLs8hzet5y06fammJDkf0yD6R32GT7q4XMNXilKQ564D1yBJygE6vZx/W3V3l8/QMr6m1lYTTk+W+29IkoxvQBZ6YXKFdnuTVkSYyanafjZwznTFSuBtBZKcgLXFFmyplcB4QlZGvdrrsEJazwwj+pnJeGx0HwV8ePbKxN',
		user => 'root',
	}
	class { 'unattended_upgrades':
		enable => 1,
		origins => $apt_origins,
		auto => {
			'clean' => 7,
			'reboot' => true,
		},
		upgradeable_packages => {
			download_only => 1,
			debdelta => 1,
		},
	}
	class { 'itzks_systems_disklserver': }
	class { 'itzks_systems_common': }
	class { 'cups_browsed_polling': }
	class { 'krb5hostkeytab': }
}

node "faiserver.intern" {
	class { 'ssh_pubkeys_admins': }
	class { 'ssh_pubkeys_firedadmins': }
	class { 'ssh_pubkeys_backupserver': }
	class { 'lsb_release_with_version': }
	class { 'unattended_upgrades':
		enable => 1,
		origins => $apt_origins,
		auto => {
			'clean' => 7,
			'reboot' => true,
		},
		upgradeable_packages => {
			download_only => 1,
			debdelta => 1,
		},
	}
	class { 'itzks_systems_faiserver': }
	class { 'itzks_systems_common': }
	class { 'cups_browsed_polling': }
	class { 'krb5hostkeytab': }
}

#node "filter.intern" {
#	class { 'ssh_pubkeys_admins': }
#	class { 'ssh_pubkeys_firedadmins': }
#	class { 'ssh_pubkeys_backupserver': }
#	class { 'lsb_release_with_version': }
#	class { 'unattended_upgrades':
#		enable => 1,
#		origins => $apt_origins,
#		auto => {
#			'clean' => 7,
#			'reboot' => true,
#		},
#		upgradeable_packages => {
#			download_only => 1,
#			debdelta => 1,
#		},
#	}
#	class { 'itzks_systems_filter': }
#}

# NOT PRESENT node "bibserv.intern" inherits "all_servers" {}
#node "opsiserver.intern" {
#	class { 'ssh_pubkeys_admins': }
#	class { 'ssh_pubkeys_firedadmins': }
#	class { 'ssh_pubkeys_backupserver': }
#	class { 'lsb_release_with_version': }
#	class { 'unattended_upgrades':
#		enable => 1,
#		origins => $apt_origins,
#		auto => {
#			'clean' => 7,
#			'reboot' => true,
#		},
#		upgradeable_packages => {
#			download_only => 1,
#			debdelta => 1,
#		},
#	}
#}
# NOT PRESENT node "displayserver.intern" inherits "all_servers" {}
# NOT PRESENT node "contentserver.intern" inherits "all_servers" {}
# NOT PRESENT node "devserver.intern" inherits "all_servers" {}

# NOTEBOOKS (aka ROAMING WORKSTATIONS)
node /(md-lap-[0-9]+|notebook-[0-9]+|test-notebook)\.intern$/ {
	class { 'ssh_pubkeys_admins': }
	class { 'ssh_pubkeys_firedadmins': }
	class { 'lsb_release_with_version': }
	class { 'browser_firefox': }
	class { 'browser_chromium': }
	class { 'unattended_upgrades':
		enable => 1,
		origins => $apt_origins,
		auto => {
			'clean' => 7,
		},
		upgradeable_packages => {
			download_only => 1,
			debdelta => 1,
		},
	}
	class { 'itzks_systems_roamingworkstation': }
	class { 'itzks_systems_common': }
	class { 'login_manager': }
	class { 'cups_browsed_polling': }
	class { 'krb5hostkeytab': }
}


# WORKSTATIONS
node /(workstation-[0-9]+|test-workstation)\.intern$/ {
	class { 'ssh_pubkeys_admins': }
	class { 'ssh_pubkeys_firedadmins': }
	class { 'lsb_release_with_version': }
	class { 'browser_firefox': }
	class { 'browser_chromium': }
	class { 'unattended_upgrades':
		enable => 1,
		origins => $apt_origins,
		auto => {
			'clean' => 7,
		},
		upgradeable_packages => {
			download_only => 1,
			debdelta => 1,
		},
	}
	class { 'itzks_systems_workstation': }
	class { 'itzks_systems_common': }
	class { 'login_manager': }
	class { 'cups_browsed_polling': }
	class { 'krb5hostkeytab': }
}

# TABLETS
node /(tab-[0-9]+|test-tablet)\.intern$/ {
	class { 'ssh_pubkeys_admins': }
	class { 'ssh_pubkeys_firedadmins': }
	class { 'lsb_release_with_version': }
	class { 'browser_chromium': }
	class { 'unattended_upgrades':
		enable => 1,
		origins => $apt_origins,
		auto => {
			'clean' => 7,
		},
		upgradeable_packages => {
			download_only => 1,
			debdelta => 1,
		},
	}
	class { 'itzks_systems_tablet': }
	class { 'itzks_systems_common': }
	class { 'cups_browsed_polling': }
	class { 'krb5hostkeytab': }
}

# default / minimal
node "default" {
	class { 'ssh_pubkeys_admins': }
	class { 'ssh_pubkeys_firedadmins': }
	class { 'lsb_release_with_version': }
	class { 'browser_firefox': }
	class { 'browser_chromium': }
	class { 'unattended_upgrades':
		enable => 1,
		origins => $apt_origins,
		auto => {
			'clean' => 7,
		},
		upgradeable_packages => {
			download_only => 1,
			debdelta => 1,
		},
	}
}